| Titel | TinyAGI tinyagi 0.0.20 External Control of File Name or Path (CWE-73) |
|---|
| Beschreibung | # Technical Details
An arbitrary file disclosure vulnerability exists in TinyAGI's response attachment pipeline. The public `POST /api/message` endpoint in `packages/server/src/routes/messages.ts` accepts unauthenticated attacker input. The response processing in `packages/core/src/response.ts` uses `collectFiles()` to parse `[send_file: <path>]` tags from agent/provider output. The function extracts the raw path and adds it to the outgoing `files` set if `fs.existsSync(filePath)` returns true — with no canonicalization, allowlist, or directory containment check. `streamResponse()` then strips the visible tag and persists the path into `responses.files`. Channel workers in `packages/channels/src/telegram.ts`, `discord.ts`, and `whatsapp.ts` consume the path directly for outbound attachment delivery via `InputFile`, `AttachmentBuilder`, and `MessageMedia.fromFilePath`.
# Vulnerable Code
File: packages/core/src/response.ts (lines 37-43)
Method: collectFiles()
Why: Extracts raw `[send_file: ...]` paths from agent/provider output and accepts any existing host path without validation.
File: packages/core/src/response.ts (lines 67-89)
Method: streamResponse()
Why: Strips the visible tag and persists the extracted file path into `responses.files` for later delivery.
File: packages/channels/src/telegram.ts (lines 498-529)
Method: Telegram worker
Why: Reads `resp.files` and hands each path directly to `new InputFile(file)` for outbound attachment delivery.
# Reproduction
1. Start TinyAGI daemon with a Telegram channel configured.
2. Send `POST /api/message` with a message that causes the agent/provider to emit `[send_file: /etc/hosts]`.
3. Retrieve pending responses via `GET /api/responses/pending?channel=telegram`.
4. Observe `files: ["/etc/hosts"]` queued for outbound delivery.
5. Confirm control case (no `[send_file: ...]` tag) produces no `files` field.
# Impact
- Arbitrary local file exposure through the outbound attachment pipeline.
- Files readable by the TinyAGI process can be queued for delivery through Telegram, Discord, or WhatsApp.
- Can expose local configuration, logs, workspace data, API credentials, and other sensitive host content.
- Unauthenticated and network-reachable through the public HTTP API. |
|---|
| Quelle | ⚠️ https://github.com/TinyAGI/tinyagi/issues/282 |
|---|
| Benutzer | JondaChen (UID 99096) |
|---|
| Einreichung | 18.06.2026 10:48 (vor 2 Monaten) |
|---|
| Moderieren | 05.08.2026 22:20 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 386402 [TinyAGI 0.0.20 Message API Endpoint response.ts collectFiles erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|